Chain agreements: feedback, correction, chunking, transport, releases

Transport and security: REST, OAuth 2.0, mTLS, x-api-key and x-jws-signature

VB-PUO uses RESTful APIs over HTTPS only, in a push model: the sender takes the initiative. Since the final Release 2027 OAuth 2.0 (client credentials) is the fixed authentication mechanism and mutual TLS (mTLS) is the principle. An API key in the x-api-key header and a digital signature in the x-jws-signature header are options (manual sections 2.7 and 7.4).

Steps

• Set-upBoth partiesExchange endpoints, OAuth clients (client credentials) and certificates, plus API keys if the parties use that option; fix the OAS version (1.0.11 for Release 2027).
• SendingSenderPOST of the JSON message with an OAuth 2.0 bearer token, optionally with x-api-key and x-jws-signature.
• ReceivingReceiverVerify the signature if there is one, validate against the schema of the stated afdDefinitionVersion and respond according to the six feedback patterns. feedback

Source: Handleiding paragraaf 2.7 en 7.4